ClawHub
Back to skill

Security audit

media-judge

Security checks for vulnerabilities and agentic risk

Overview

The scanners describe a media-judging skill whose purpose appears coherent, but flag undeclared network access and unpinned installation sources, so the verdict is suspicious with medium confidence; the scan is partial.

Consider the scanner’s recommendation not to install until you have reviewed the network downloads, installation source pinning, and storage of face crops. Treat the result as incomplete: although all listed components were inspected, the scan status is partial because several referenced paths were unresolved.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (20)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md
## 1. Who judges

If you made this media, you do not judge it in this context. Start a fresh agent with no knowledge of the prompts or
of how it was made, and give it only the file, this skill, the brief (what it must say, names, product) and the
references. If you cannot start one, write `self-judged` at the top of the verdict.

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md
Work through `questions` in `runs/film/facts.json`. Each one names the frames to open and one narrow question. Read
`references/eyes.md` first. The rules that change results:

- Open `contact_sheet_*.jpg` and each flagged `evidence` file. Do not judge from memory of the prompt.
- Ask "describe" and "what is unusual", never "what is wrong" (57.2% against 29.5% on [GlitchBench](https://arxiv.org/abs/2312.05291)).
- Answer per shot, with yes or no, a time, and something you can quote from the frame to prove you looked.
- Do not estimate where people look. Models score about 0.34 to 0.41 against real gaze. Use the heat map.

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/observe-prompt.txt (reported line 1)May include surrounding context.

text
Report only what you can see in the frames. Do not judge, compare or give an opinion. Frames are numbered 1 to 12, reading left to right, top to bottom. Use an empty list when there is nothing to report.

misspelled: every word on screen that you can read and that is misspelled, quoted exactly. Skip brand names and code.
hard_to_read: every line of text that blends into what is behind it, quoted as well as you can. Skip tiny interface text.

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · scripts/judge.py (reported line 123)May include surrounding context.

python
q = []
    def ev(name):
        return [e["evidence"] for e in by.get(name, {}).get("events", []) if isinstance(e, dict) and e.get("evidence")]
    q.append({"id": "story", "covers": "reverse engineering", "open": sheets, "ask": "Describe each shot in one line and name its subject. Do not judge it."})
    q.append({"id": "lead", "covers": "2 nothing leads the eye", "open": [by.get("leads_the_eye", {}).get("measured", {}).get("attention_sheet")], "ask": "The heat map is a measurement. For each shot, write the subject, then yes or no: does the top peak sit on the subject? Give the shot number."})
    q.append({"id": "scale", "covers": "1 everything is the same size", "open": sheets, "ask": "Per shot: name the largest element and the second largest. Write 'same size' when they are about equal."})
    q.append({"id": "product", "covers": "3 product is not readable", "open": sheets, "ask": "At each shot that shows the product: can you read its name and tell what it is from the frame al

Code capability 'env' detected in scripts/judge.py but not covered by declared permissions.

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'env' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.

Content

No source excerpt is available for this finding.

Code capability 'network' detected in scripts/mj_common.py but not covered by declared permissions.

High
Category
MCP Least Privilege
Confidence
87% confidence
Finding

fetch_model performs outbound requests and persists downloaded models despite the reported absence of declared network permission. Model acquisition is legitimate for this skill, but undeclared automatic networking violates the expected capability boundary; additionally, downloaded and cached model bytes are accepted without integrity verification.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The installation command runs an unpinned npm CLI and installs skill content from a mutable repository reference. A compromised future release or repository update could introduce code or agent instructions with the user's privileges; this is a supply-chain weakness, although the scanner incorrectly describes the CLI as an MCP server.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y skills'.

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The prompt directs an agent to execute an unpinned npm package with automatic confirmation, install mutable remote skill content, and then follow that content. Compromise of either upstream could therefore become local code execution or malicious agent behavior; the legitimate media-review purpose does not remove this supply-chain risk.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · references/recipes/sound_vs_cuts.py (reported line 10)May include surrounding context.

python
path = sys.argv[1]
cuts = np.array([float(c) for c in sys.argv[2:]])
sr, hop, n = 22050, 256, 1024
raw = subprocess.run(["ffmpeg", "-v", "error", "-i", path, "-f", "f32le", "-ac", "1", "-ar", str(sr), "-"], capture_output=True).stdout
y = np.frombuffer(raw, np.float32)
win = np.hanning(n)
frames = np.stack([y[i:i + n] * win for i in range(0, len(y) - n, hop)])

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/mj_audio.py (reported line 23)May include surrounding context.

python
cmd = ["ffmpeg", "-v", "error", "-nostdin", "-i", path, "-map", "0:a:0", "-f", "f32le", "-ar", str(sr)]
    cmd += ["-ac", "1"] if mono else []
    cmd += ["-"]
    proc = subprocess.run(cmd, capture_output=True)
    return np.frombuffer(proc.stdout, np.float32).copy()

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/mj_common.py (reported line 168)May include surrounding context.

python
vf = ["-vf", f"scale={width}:-2"] if width else []
    cmd = ["ffmpeg", "-v", "error", "-nostdin", "-ss", f"{max(t, 0):.3f}", "-i", path, "-frames:v", "1", *vf,
           "-f", "image2pipe", "-vcodec", "png", "-"]
    proc = subprocess.run(cmd, capture_output=True)
    if not proc.stdout:
        return None
    return cv2.imdecode(np.frombuffer(proc.stdout, np.uint8), cv2.IMREAD_COLOR)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/mj_common.py (reported line 30)May include surrounding context.

python
def run(cmd: list[str], check: bool = True, **kw) -> subprocess.CompletedProcess:
    return subprocess.run(cmd, check=check, capture_output=True, text=True, **kw)


def have(binary: str) -> bool:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/mj_common.py (reported line 149)May include surrounding context.

python
"ffmpeg", "-v", "error", "-nostdin", "-i", path, "-map", "0:v:0", "-fps_mode", "passthrough",
        "-vf", f"scale={width}:{height}:flags=area,format=bgr24", "-f", "rawvideo", "-",
    ]
    proc = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL)
    size = width * height * 3
    try:
        while True:

Face-continuity checks save identifiable face crops to disk without disclosing that persistence.

Medium
Category
Output Handling
Confidence
86% confidence
Finding

_pair writes identifiable face crops as persistent JPEG evidence without any visible privacy controls or retention policy. Evidence generation is an expected feature and no upload is shown, which limits the concern, but these additional face-focused artifacts can remain accessible or be shared separately from the original media.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/mj_text.py (reported line 47)May include surrounding context.

python
import io
    import subprocess
    ok, buf = cv2.imencode(".png", img)
    proc = subprocess.run(["tesseract", "stdin", "stdout", "--psm", "11", "tsv"], input=buf.tobytes(), capture_output=True)
    lines: dict[tuple, dict] = {}
    for row in csv.DictReader(io.StringIO(proc.stdout.decode("utf8", "ignore")), delimiter="\t", quoting=csv.QUOTE_NONE):
        txt = (row.get("text") or "").strip()

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/mj_text.py (reported line 491)May include surrounding context.

python
w, h = x1 - x0, y1 - y0
    cmd = ["ffmpeg", "-v", "error", "-nostdin", "-ss", f"{max(t0, 0):.3f}", "-t", f"{t1 - t0 + 0.2:.3f}", "-i", path, "-vf",
           f"crop={w}:{h}:{x0}:{y0},format=gray", "-fps_mode", "passthrough", "-f", "rawvideo", "-"]
    raw = subprocess.run(cmd, capture_output=True).stdout
    n = len(raw) // (w * h) if w * h else 0
    return np.frombuffer(raw[: n * w * h], np.uint8).reshape(n, h, w) if n else np.zeros((0, h, w), np.uint8)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/make_fixtures.py (reported line 39)May include surrounding context.

python
def read_clip(path: str, start: float, dur: float, w: int = W, h: int = H) -> np.ndarray:
    vf = f"scale={w}:{h}:force_original_aspect_ratio=increase,crop={w}:{h},fps={FPS},format=bgr24"
    cmd = ["ffmpeg", "-v", "error", "-nostdin", "-ss", str(start), "-t", str(dur), "-i", path, "-vf", vf, "-f", "rawvideo", "-"]
    data = subprocess.run(cmd, capture_output=True).stdout
    n = len(data) // (w * h * 3)
    return np.frombuffer(data[: n * w * h * 3], np.uint8).reshape(n, h, w, 3).copy()

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/make_fixtures.py (reported line 118)May include surrounding context.

python
if audio is not None:
        cmd += ["-c:a", "aac", "-b:a", "192k"]
    cmd += ["-shortest", str(path)]
    p = subprocess.Popen(cmd, stdin=subprocess.PIPE)
    for f in frames:
        p.stdin.write(np.asarray(f, np.uint8).tobytes())
    p.stdin.close()

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/run_bench.py (reported line 27)May include surrounding context.

python
facts = out / "facts.json"
    if fresh or not facts.exists():
        cmd = ["uv", "run", "--quiet", "--script", str(JUDGE), "video", str(fixtures / f"{name}.mp4"), "--out", str(out), "--music-only", *[x.replace("{fixtures}", str(fixtures)) for x in spec.get("args", [])]]
        p = subprocess.run(cmd, capture_output=True, text=True)
        if p.returncode not in (0, 1):
            return name, None, p.stderr[-800:]
    return name, json.loads(facts.read_text()), ""

tests/run_bench.py L084-L086 says detections must match the planted moment, but accepts detections with no event timestamps.

Medium
Category
Excessive Agency
Confidence
99% confidence
Finding

The comment explicitly requires an event to land on the planted moment rather than just anywhere. However, the or not times condition counts a flagged check as a hit even when the fixture specifies at and the check provides no timestamped events, inflating the benchmark's reported catches without verifying localization.

Content

No source excerpt is available for this finding.